Did this Tor developer become a victim of NSA's laptop interception program? - <AUTHOR> http://privacysos.org/node/1311 <comment><USER2> HEY, KIDS! Do YOU know what time it is?!

 _[wild audience applause]_

THAT'S RIGHT, it's time for _WHICH IS MORE LIKELY?_!

 _[intro music]_

Today on _Which is More Likely?_ , we're looking at a replacement Lenovo Thinkpad keyboard that was shipped to Alexandria, Virginia, instead of Seattle, Washington. What a blunder! _[slide whistle sound effect]_

Now put your thinking caps on and ponder, _WHICH IS MORE LIKELY?_!

• The largest intelligence agency on the planet, recently outed by Snowden's leaked documents for operating a multi-decade worldwide dragnet that secretly gathered communications on hundreds of millions of people, was too incompetent to have the US Postal Service display tracking information that hides the fact they're modifying a laptop keyboard in order to _somehow_ spy on a Tor developer.

ORRRRRRRRRR!

• The third-party seller who uses Amazon to accept orders screwed up and gave Amazon the wrong tracking number.

That's all we have time for on today's episode of _Which is More Likely?_ Don't change the channel! Up next is a BRAND NEW episode of _Godwin 's Law and Order_! Good night from Hollywood!

 _[outro music]_

<comment><USER3> Oh, I like this game. Let's play again: _WHICH IS MORE LIKELY?!_

* The world's largest online retailer that does $54M in sales per day has a bug in its procurement system that randomly transposes tracking codes.

ORRRRRRRR!

* The intelligence agency whose massive scope and pervasive operational shortcomings were recently exposed by one low-level operative had a slip-up in applying a well-publicized tactic to an obviously high value target.

On the other hand, what's great about your way of putting it is that it juxtaposes your belief in the all encompassing nature of the NSA's programs with your incredulity that such a program might have been applied specifically here. I also like the part where the NSA is guarded by the Catch-22 "it wasn't them, because if it was, you'd never know", such that that there's no scenario in which you could be convinced that the NSA did _anything_.

And yet again, maybe it's time to stop thinking of the NSA as some far-off abstraction and start thinking about it is an actual thing that affects our daily lives.

<comment><USER2> _The intelligence agency whose massive scope and pervasive operational shortcomings were recently exposed by one low-level operative had a slip-up in applying a well-publicized tactic to an obviously high value target._

A few comments:

• This "low-level operative" was a system administrator who used social engineering to obtain other people's authentication credentials and gain access to material to which he wasn't authorized. He wasn't the janitor or some clueless field agent.

• Did Snowden expose operational shortcomings? Absolutely. A lot of the programs that have been publicly revealed through his leaks have been running for over a decade without ever seeing the light of day, though. That tells me these "pervasive operational shortcomings" aren't very pervasive. (If they were, the NSA would be absolute shit at their mission.)

• I don't think Andrea is a "high value target," or at least high value enough to risk compromising whatever method they might use to bug her keyboard. I don't say this to belittle her or her work in any way — she seems to be a skilled programmer/hacker/infosec person. And that's exactly why this whole "the NSA is bugging her keyboard" theory doesn't make any sense.

Let's assume for the sake of argument that the NSA had planned to bug her keyboard, and that keyboard is now sitting in an NSA (or contractor) facility in/near Alexandria, Virginia, waiting for some modification to be made before shipping it back out. But, oops, they screwed up and forgot to fake the USPS tracking information. They know she knows because she tweeted about it. She's also tweeted that she can never trust the keyboard if/when it shows up. Why would they ship her a bugged keyboard at this point? If/when the keyboard shows up, she's probably going to take it apart and share anything interesting she finds with the world. There will be hard evidence.

Even if they hadn't bungled the tracking information in our hypothetical argument, they're risking exposure of the exact methods they use to bug a machine for not much potential gain. (Remember, Andrea's a skilled hacker/programmer. There's a very good chance she'll figure out what's going on and tell the world if she has any inkling that her laptop's been tampered with.)

• The keyboard she ordered fits a ThinkPad T60/T61/T400/T500 (and the equivalent "R" models, plus a few others). Internally, the keyboard and TrackPoint speak PS/2\. While they could log keystrokes to an on-board chip and transmit keystrokes via radio, there aren't any especially interesting things the NSA can do to her laptop via a modified keyboard. They certainly won't be rooting it that way.

• I said that I don't think Andrea is a "high value target," despite her work on Tor, because everything about Tor is open. Anyone can download the code and see exactly how it works. The protocol is well-known. There's no curtain to peek behind and gain strategic information about Tor's workings.

So while I don't reject the argument that the NSA is trying to bug her laptop as impossible, I think it's exceedingly improbable. My money's still on "seller screwed up the tracking number."

 _I also like the part where the NSA is guarded by the Catch-22 "it wasn't them, because if it was, you'd never know", such that that there's no scenario in which you could be convinced that the NSA did anything._

The flip side of this argument, which everyone here seems to be clutching onto and running with, is that if the NSA is capable of it, they're doing it at every available opportunity, even when it doesn't make any sense to.

<comment><USER3> That generated more response than I expected. I actually _do_ agree that, on balance, it's somewhat more likely that it's just a benign glitch; I should have said that. What I was really taking issue with is the dismissiveness with you treated the suggestion that this might be an NSA attack. I was responding to what I saw as a slanted and unreasonable framing by doing the same thing from the other end.

So with less snark: I don't think it's exceedingly improbable at all, and whether ultimately it turns out to be the case or not, smugly guffawing the idea that the NSA may have used a trick like that isn't warranted. They really do intercept people's laptop shipments [1] to plant malware in them. They really do sneak tiny radio transmitters into end-user hardware. They really are trying to get backdoors into communication tools. I'll put it this way: if I worked on the kind of software Andrea works on, I would be seriously alarmed. Would you keep the keyboard?

On some specific points you made:

* That Snowden had access to other people's credentials seems like a serious operational shortcoming to me. The "low-level" part wasn't an attack on Snowden; the point is that a lot of people have that level of access. In general, the US intelligence apparatus makes a lot of well-publicized mistakes; I'm sure they make a great number of more subtle ones.

* On the NSA's shortcomings generally, I think this is actually nicely illustrative. Because a lot of the stuff Snowden revealed were things a lot of credible people already believed, based on things like weird locked server closets in telecom buildings and PRNGs that seemed fishy and pointless and heresay reports of requests for backdoor access to communication tools and so on. There was just little hard evidence before Snowden. And there won't be here either. So this is entirely consistent with the what the NSA was like in those decades where their programs "never saw the light of day".

* I think being a core Tor developer makes her high value target. It's hard to imagine the NSA wanting to subvert all the things it's subverted and not wanting to backdoor Tor. Keylogging her keyboard is a great way to do that, either by compromising her somehow, or by just stealing her credentials. So I don't follow the "it doesn't make any sense" line of thinking.

* That she's now tweeted about certainly makes it unlikely that, if the NSA has it, they'll go through with sending it bugged. But so?

Where I come out on this is that yes, it's probably nothing, but it should be treated with suspicion and carefulness, not laughed off because _haha, what, do you think you 're in a spy movie or something?_ Because, basically, we are.

[1] Yes, I know this is just the keyboard. I don't think that's a relevant difference.

<comment><USER2> _What I was really taking issue with is the dismissiveness with you treated the suggestion that this might be an NSA attack. I was responding to what I saw as a slanted and unreasonable framing by doing the same thing from the other end._

I was dismissing the linked blog post as much as the suggestion of NSA involvement. The blog post took a single tweet with a single screenshot, screwed up half the facts ("tracking details for a computer Shepard ordered" — uh, no, it was a used laptop keyboard), sensationalized the other half ("it moved another four times around the military and industrial belt" — uh, no, it moved from IAD to Alexandria), and tacked a pile of rhetorical questions and conjecture on the end.

I somehow expected better from an ACLU chapter.

</comment></comment></comment></comment></comment><comment><USER4> The obvious explanation here is that the USPS fucked up. As the tweet says, you'd think the NSA program would be more subtle. Further, there isn't much in the way of intelligence presence in Alexandria. So what's more likely: that the NSA does this program in a secret location that's still right next to all the non-secret stuff, and they can't cover up the tracking data, or that the USPS accidentally sent a package to the wrong place?

Edit: I want to emphasize how incredibly stupid the article is when analyzing the tracking data. Key quote:

"From Dulles, it moved another four times around the military and intelligence belt in suburban Washington DC, finally landing in Alexandria at 11:03 am on January 23."

First of all, there is nothing significant to Dulles. It's the largest airport in the area, and this makes it the arrival point for any packages coming in by air. 90% of my packages have a "Dulles, VA" tracking entry on them by the time they get to me.

Second, it didn't move "four times". It went from Dulles to a carrier facility in Alexandria, then it went out for delivery and got delivered. That's two moves. And how many times do you _expect_ it to move? That's how air-based package delivery works. It goes to an airport. Then it goes to a local sorting facility. Then it goes out for delivery.

Third, the phrase "military and intelligence belt" is ridiculous. Especially so when the only two locations involved are Dulles and Alexandria, neither of which has much in the way of either military nor intelligence.

The article tries _way_ too hard to make its case, and uses a great deal of purple prose to state what comes down to, "the package got delivered to Alexandria, VA which is close to a lot of government agencies". That would actually be more convincing than the insanity they wrote, although still not very convincing. But at least it would be honest.

<comment><USER5> At this point aren't we all just guessing? Reading this thread I'm surprised how strongly many folks I respect (like you - viva FQ&A!) are insisting this could not be an NSA screw up. The truth is we don't know, so why rush to conclusions (even benign conclusions) instead of waiting to learn more?

And imagine if you were Andrea and you develop software that dissidents around the world depend on with their life, while also knowing the NSA has simultaneously tried to weaken it. If the laptop does get rerouted to her with an apology from USPS and you were her, are you saying you wouldn't hesitate even a little before accepting it and transferring your data onto it?

Ultimately, I think that's the real story here. The biggest problem with having a government that watches its citizens isn't the watching per se, it's the loss of trust.

<comment><USER4> Yes, we are all just guessing.

And I think you misunderstand. I am not arguing that it "could not be" the NSA. And I haven't see anyone say that. I am simply arguing that it is extremely unlikely.

It's a guess, yes, but it's an informed guess. It's a matter of looking at probabilities and seeing what's more likely. Shippers screw up all the time. Packages make crazy detours because somebody tossed a box in the wrong truck. A label falls off and a mixup occurs. Somebody typos a tracking number.

On the other hand, for this to be the NSA, several unlikely things would have to be true:

1\. The NSA would need to be intercepting computer equipment destined for certain people and modifying it to spy on them.

2\. The NSA would need to be targeting the person in question for this program.

3\. The NSA would need to have set up this program in such a boneheaded way that it shows up on a package tracker. (If I were in charge of this program, I'd just set it up in FedEx's sorting facility in Memphis and then ensure all the relevant equipment uses FedEx. Simple, fast, and no chance of the target finding out.)

4\. The NSA would need to have set up this program in Alexandria, even though it has little to recommend it for such a thing.

Now, we know that #1 is actually true. So that's one requirement fulfilled, out of several. But what about the rest?

I'm somewhat skeptical on #2. It's possible, but it seems unlikely. Why would the NSA target Tor developers? The security of Tor falls apart in the presence of an adversary that is able to monitor the entire internet, because you can just correlate traffic that enters with traffic that exits. The NSA can presumably monitor enough of the internet to defeat Tor right now. So why bother spying on Tor developers? It's _possible_ as a belt-and-suspenders maneuver, but this person just doesn't strike me as a likely target.

I'm _really_ skeptical on #3. It's about as believable as having the FBI spy on me by parking a van outside my house that says "Flowers By Irene". It's possible, but really unlikely.

And #4 doesn't make a whole lot of sense to me. Again, possible, but unlikely.

So we have one thing that's true, and then several other things that are individually unlikely, and combine to be really unlikely. It looks to me that people are committing the basic fallacy of thinking that the truth of #1, since it's unlikely, somehow makes the rest more likely too.

It comes down to this: is it a screwup by USPS or Amazon or a third-party reseller, or is it the NSA screwing up royally while trying to plant a bug? In the absence of evidence, we are stuck guessing, but we can guess _intelligently_ by realizing that one is vastly more likely than the others.

"When you hear hoofbeats, think of horses not zebras."

That doesn't mean zebras are impossible. But it means you should prefer the more obvious explanation unless there's evidence to the contrary.

<comment><USER5> Fair enough, and thanks for the thoughtful reply. I didn't mean to misrepresent your position -- I took "The obvious explanation here is that the USPS fucked up" to mean you belived it couldn't be otherwise, rather than when weighing the evidence the more obvious [simpler] explanation is that USPS screwed up.

Like you, I'm also a big proponent of Occam's razor. (Having been a med student, you don't know how many times I heard that "think horses not zebras" analogy from attendings.) I guess it just comes down to the degree of faith each of us has in the NSA and their corporate partners. Some of us are more willing to doubt their actions and/or believe it's possible they could screw up this way. But at this point we can only wait and see if we learn anything more in the coming days -- though probably not. One would hope the NSA is competent enough to cover this up, even if it was their screw up.

 _Added:_ BTW, there is another explanation that no one has mentioned. Leaving the Alexandria issue aside, the NSA interception program obviously relies on participation from one or more corporate partners. And just as we've seen at the telcos, it's reasonable to assume that there are staff at those partners who aren't particularly enthusiastic about the program. So it's possible someone decided to "accidentally" bypass/skip an important step that would have obscured this. It's not a huge leap to imagine a motivated techie realizing that this particular delivery would be an ideal opportunity to direct a lot of attention to the interception program -- if they felt compelled to take the risk. I'm definitely not saying this is the (or even _a_ ) likely possibility, but it's probably the only way we'll ever know if it was in fact the NSA.

</comment></comment></comment></comment><comment><USER6> When I read the headline, and the comments here before reading the article, I was expecting to see tracking data that went from the seller to the buyer with a mysterious stop near the NSA.

Then I read the article. The tacking data shows a _delivery_ to a destination near the NSA.

Does anyone here seriously think that the mechanism the NSA uses if they want to tamper with a laptop on the way to simply change the _destination_ address to be the NSA? And that no one has noticed this before?

If they are intercepting and modifying domestic shipments, the mechanism would be something that is executed AT the shipping carrier facilities or possibly during the final delivery, and would be completely transparent to outside observers, including both the sender and the receiver of the package.

Watch the "Modern Marvels" episode on package delivery for a look at how the automated package movement systems work at the major hubs, and you'll see how a package could be diverted for special treatment and then re-inserted into the system transparently, with most workers at the facility having no idea something special is going on.

The best chance at detecting this from outside would probably be to look at next day delivery orders on items that would be the most time consuming to modify, to see if those are more likely to miss their delivery deadline. The idea is that with such a tight schedule, the chances are higher than an interception will blow the delivery schedule. For items ordered with two day or longer shipment, the delay in modifying the item could be made up by upgrading it to one day delivery in the system when it is re-inserted. That's why observing one day delivery items is the best bet.

<comment><USER7> Genuinely curious about the Modern Marvels episode. Do you remember the exact name or season? I couldn't find it on iTunes.

<comment><USER6> I believe it was season 5, episode 1, "Deliver It". They focus on UPS but things would be similar for other carriers. The UPS part starts about 9 minutes in. If you have Amazon Prime, they have it for free streaming.

BTW, UPS would be particularly good for intercepts, because UPS operates an electronics repair facility that does factory authorized repairs. When you think you are sending your broken laptop by UPS to, say, Toshiba, it can get automatically diverted to the UPS repair facility a couple miles from the hub, where Toshiba-trained technicians do the repair.

This means that a laptop shipment being diversion for the NSA would not even have to be done with some secret diverter on the line somewhere. They could just make it look like an ordinary repair job. The repair facility is large. Who would know if one or two of the repair technicians are really NSA agents?

</comment></comment></comment><comment><USER8> As much as I'd like to believe that they did mess up the interception reporting (if they really do interception like that), I've seen enough crazy tracking reports that I wouldn't be surprised if it was just a stupid mistake.

Just googling for "funny delivery tracking route" for example will give you things like:

\- 4 times over the ocean - [http://i696.photobucket.com/albums/vv325/oneupmanship34/Fg0e...](http://i696.photobucket.com/albums/vv325/oneupmanship34/Fg0eg.png?t=1265425500)

\- let's send it to Canada, 3 times - [http://i30.photobucket.com/albums/c325/duffer987/UPSFTD_zps6...](http://i30.photobucket.com/albums/c325/duffer987/UPSFTD_zps68aae690.jpg)

\- Germany, HK, Germany, HK, ... - [http://laforge.gnumonks.org/fun/dhl-hk- leipzig-hk-leipzig-hk...](http://laforge.gnumonks.org/fun/dhl-hk-leipzig-hk- leipzig-hk.jpg)

Getting a strange route within one country is probably an improvement compared to those...

</comment><comment><USER9> ITT, people who have never been to DC. Dulles is one of the main airports everything flys into for DC. As for as I know, it is the biggest.

Dulles has a lot of government contractors and big companies in the area, but that's about it.

What would be suspicious is if it went from Dulles to Langley, from Langley to Ft. Meade, from Ft. Meade to Quantico, and from Quantico to Alexandria....but Dulles to Alexandria is really standard.

edit: It isn't like it got back on a plane and went back to Seattle to be delivered to this girl. It looks like they straight delivered it to the wrong city. The government has pretty good OpSec when it comes to things like this. You think they would straight up route her package through Ft. Meade if they were planning to install malware on her computer?

<comment><USER4> Yep, the last few lines of the package tracking could have come from about 90% of the packages I had delivered to my house in the past few years, until I moved out of Alexandria.

</comment></comment><comment><USER10> I'm a bit confused here. On the bottom right, it says that the package contained a replacement keyboard, and not an actual laptop.

<comment><USER11> But when that keyboard gets plugged into the motherboard of the laptop, it'll have an opportunity to install malware in the form of device drivers.

<comment><USER12> Worse: laptop keyboards are usually connected to a special embedded firmware (IIRC on my Clevo laptop it's called EC, short for embedded controller), which handles the FN+x key combos like LCD brightness, volume control, keyboard backlight (Lenovo!), WiFi/BT/cellphone-data connectivity, webcam enabling (!) and other detailed functions.

Now, if this EC chip is vulnerable, a malicious keyboard can have direct DMA access (just like FireWire controllers, EC is usually connected to the main PCI bus)... no need for drivers here.

<comment><USER13> As per my other post, the keyboard is most likely a PS2 keyboard interface (physical or emulated) connected to a simple PS2/LPC(ISA) bus interface inside the EC. It will literally deliver an IRQ to that bus (IRQ 1) at which point the EC has to suck down a character from the keyboard buffer and do something with it.

It's not clever, can't use DMA and generally is the dumbest thing in the entire machine.

If they somehow manage to work around it I'd eat a box of lightbulbs. It's hard enough to coerce it to work to start with.

Source: I used to design embedded PC kit from the board level.

<comment><USER12> Thanks for the clarification!

But one question remains: how does the EC control stuff like the bluetooth radio and webcams? They're USB devices to the OS, so in theory there should be a USB hub inside the EC?

<comment><USER13> Not necessarily. It may only have power control function. If you pull a USB device out it's the same as turning it off in theory and vice versa. It's probably just turning the device off or setting it into standby mode.

edit to add: some Intel south bridges have integrated EC which makes things a little uncertain.

</comment></comment></comment></comment></comment></comment><comment><USER14> Whether this actually happened or not is not the point.

The point is that there is now speculation (and in fact a, albeit remote, possibility) that this could have been the reason.

The loss of trust in the Government is what makes this a story.

<comment><USER15> I find the loss of trust in the gov't encouraging. Healthy skepticism would be better, but distrust is better than nothing.

</comment></comment><comment><USER16> Never attribute to malice that which is adequately explained by opaque logistics.

<comment><USER17> Never say never. NSA intercepting its target's purchases to install spyware is very much possible.

<comment><USER16> It's possible, but there is no evidence suggesting that is what happened here.

The overwhelming likelihood is that the package simply took an unusual route due to factors that are unknown to us. For this story to be true, it would require a level of incompetence that is orders of magnitude beyond that which we have previously seen from the NSA.

</comment></comment></comment><comment><USER18> You only phrase your headline as a question if the answer is No, but you really want it to be Yes.

<comment><USER4> It fits. The answer is almost certainly No (an honest mistake is far more likely, and nefarious activity wouldn't look like this anyway), and you can tell from the way they write (e.g. vastly exaggerating the import of the tracking info) that they deeply _want_ this to be true.

<comment><USER19> Clearly, absence of evidence is evidence of conspiracy, and evidence to the contrary is propaganda. It's the only way to know for sure.

<comment><USER4> I give it about 50/50 odds that a followup article shows up along the lines of, "they received the laptop and the tracking info for this package shows it coming straight from the warehouse nearby _and this is clearly evidence that the NSA is screwing with USPS tracking data_."

<comment><USER19> The site which posted this article wouldn't bother posting an article contradicting it.

</comment></comment></comment></comment></comment><comment><USER20> I hope this was not posted before the keyboard arrived. Should be easy enough to have it taken apart by an expert and see if anything is fishy (and to check if tracking numbers match).

If it was posted before...why would you do that.

<comment><USER21> Looks like she posted it before... Either way I would cut her access to the Tor project.

</comment></comment><comment><USER22> All this speculation about what any TLA's may or may not have done seems fruitless to me. If the keyboard seems legitimately suspect, send it to someone to do a teardown or plug it in and capture communications, and find out. That way we'll learn something concrete, and not reinforce this 'NSA of doooooom' crowd mentality.

</comment><comment><USER23> The amount of apologetic in this thread is hilarious.

Do you all expect to see "SECRET NSA WAREHOUSE" on the packing slip?

<comment><USER24> Apparently, they do. Until Snowden releases something along the lines of "List with 1.500 gadgets that Amazon released that were bugged". Then suddenly we'll be like " _Oh Jeez, I thought but it but I never really believed..._ ".

The thing is "Would the NSA wanna bug a TOR developer's computer"? and the answer is "Damn, sure!".

So it's not as far fetched as many here believe imho - and NO there are not many _better_ ways than this, I can't think of any.

<comment><USER25> Exactly. This is why many people in tech weren't that surprised by Snowden's leaks and were slightly relieved just to see all the suspicions verified. But most people seem to need a powerpoint explicitly stating what's going on before they believe it. Prior leaks from NSA defectors without hard proof had almost no recognition by the public. Even full in-depth exclusives from Washington Post didn't seem to affect people.

</comment></comment></comment><comment><USER26> No.

[http://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines](http://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

</comment><comment><USER27> I'm inclined to believe that this is a mistake - "extraordinary claims require extraordinary evidence" and all that.

...However, since hypothetically this could happen, how could it be prevented? Would there be some unbreakable way for a manufacturer to tell you if the keyboard had been tampered with?

I was thinking of those silver foils that are now put over a lot of food items so that crazies can't put stuff in them in the supermarket. I appreciate wrapping it in plastic probably wouldn't be enough to defeat the security services, but you get the idea.

</comment><comment><USER28> Why would the NSA fuck with a TOR developer, when the federal government contributes a great deal of TOR code and actually runs exit nodes as a matter of research?

<comment><USER15> >Why would the NSA fuck with a TOR developer,

Why wouldn't they? At the very least a TOR developer might find themselves in the same room with interesting people.

> when the federal government contributes a great deal of TOR code

The US gov isn't a single monolithic entity with a singular purpose and every person working in lock-step.

> and actually runs exit nodes as a matter of research?

I wouldn't trust a gov't run TOR node. It may be fine for dissidents in uninteresting countries, but not for anyone who wants to keep their privacy safe from the US gov't.

</comment></comment><comment><USER29> Bugs in software are so uncommon these days that I always assume any malfunctions are due to government interference. A human making a mistake while programming or using a computer? Not bloody likely. The government trying to infect my laptop with malware contained in a replacement keyboard? That's the only possible explanation!

</comment><comment><USER30> Buy a new boxed computer with cash from a local supplier. I doubt the NSA has installed something on every single computer.

<comment><USER31> Some OS developers are sufficiently concerned that CPUs are NSA-modified to not trust, say, Intel's rdrand instruction anymore!

It may very well be that every single Linux system running on a recent or semi-recent CPU has a rdrand instruction returning a number "nullyfying" (from the NSA's point of view) the previous entropy sources XOR'ing.

You may call me "paranoid" but... Many people who were categorized as paranoids years ago turned out actually to be very, very far from the truth and not anywhere near paranoid enough.

I also remember a SNAFU years ago where a Windows version was compiled with some symbols left on and people started noticing variable named things like: "NSA_KEY". And, of course, lots of PR ensued and there was nothing to see and there were very reasonable explanation as to why there were NSA specific things in Windows.

Contrarily to you I believe it is very likely that most Windows and Apple OSes are backdoored by the NSA and I believe it's far from impossible that several piece of hardware are also backdoored.

I also think it's not impossible that several network cards have "kill switches" where a certain packet combination bricks the card . There have been weird reports out there from people seeing really strange things making such a possibility not science-fiction.

<comment><USER32> Can we get a source for that SNAFU claim? If true I would be very interested to read more about it.

<comment><USER4> Wikipedia actually has a pretty lengthy article about it:

[http://en.wikipedia.org/wiki/Nsakey](http://en.wikipedia.org/wiki/Nsakey)

</comment></comment></comment></comment><comment><USER33> I don't get the "installing malware" part.

Every PC comes with malware already installed by most manufacturers. (Yes, if I have to spend time removing bloated stuff it's malware, I don't care if it's an "antivirus demo" or something like that)

Now, if it's a hardware detail, this is more interesting.

<comment><USER34> Not all malware can be removed the way you remove that antivirus demo. From the Der Spiegel article[1]:

> Take, for example, when they intercept shipping deliveries. If a target > person, agency or company orders a new computer or related accessories, for > example, TAO can divert the shipping delivery to its own secret workshops. > The NSA calls this method interdiction. At these so-called "load stations," > agents carefully open the package in order to load malware onto the > electronics, or even install hardware components that can provide backdoor > access for the intelligence agencies. All subsequent steps can then be > conducted from the comfort of a remote computer.

Naturally, if they also load a keyboard logger or whatever, no amount of formatting that new laptop would help.

[1] [http://www.spiegel.de/international/world/the-nsa-uses- power...](http://www.spiegel.de/international/world/the-nsa-uses-powerful- toolbox-in-effort-to-spy-on-global-networks-a-940969-3.html)

</comment></comment><comment><USER35> So buy your laptop from the store, not online? Guess this is good news for Best Buy, not so much for Newegg.

</comment><comment><USER36> Really stupid move to post this on twitter before getting it. Should have just taken a screenshot then waited for it to show up. Then post the screenshot and have people analyze the keyboard.

By posting before getting the package, the NSA could see the Twitter post and give a non-modified one instead.

</comment><comment><USER37> I wonder what she's going to do with the keyboard when she gets it. Send it back and buy one locally? Examine it in detail for bugs/weirdness, and then use it normally? Connect it to a spare laptop, and use it to do searches for the weirdest porn you can think of?

<comment><USER38> Nerds need pr0n :)

</comment></comment><comment><USER38> Isn't it obvious this is some kind of weird reverse-psychology ? They can always call catch 22 , or they need not to , we can only guess . But it's kind of obvious this happened to dismiss the fact they ARE doing this on regular basis .

</comment><comment><USER39> Nonsense. Every single piece on those laptops already leaks more than a teabag, every protocol does more information broadcasting than the BBC, why would they have it shipped to the headquarters?

NSA's job is to bug computers before they even enter Amazon.

<comment><USER24> The reason we're discussing this, is because of the laptop's/keyboard's owner: A TOR developer. If this was uncle Joe no one would even care, because probably his Facebook data is all that matters anyway.

</comment></comment><comment><USER40> I live in Ashburn, VA. I've had a package routed through Ashburn, GA. Someone got confused between Washington(the state) and Washington(DC)...? Occam's razor people...

<comment><USER41> So, Alexandria, VA and Seattle, WA are spelled the same?

</comment></comment><comment><USER42> fwiw I recently had a large, professional shipment company state that my product had been delivered to the new town over, albeit to the same street address I had ordered it to.

The product was in my po box, but the shipping company claimed it wad delivered to another adjacent town.

Never attribute to malice that which is adequately explained by stupidity.

</comment><comment><USER43> That would be a very ordinary rendition.

</comment><comment><USER44> I suppose it's possible this could just be a fox's paw on the part of the shipping company.

<comment><USER45> A few months ago, I ordered some RAM from Crucial. They used UPS Mail Innovation, a service by UPS that mails packages for you. I got my package, but the tracker showed it getting delivered to another address on the other side of the country. So maybe there's a bug somewhere in the USPS system that shows you the tracking of the wrong package?

</comment></comment><comment><USER46> So let me get this logic:

NSA contractor reveals mass surveillance on population

Independent journalists reporting on the topic has their home broken into

Independent article reports on NSA modifying laptops bound for "terrorists"

Tor developer notices laptop shipping traversing through the opposite direction

Tor developer is concerned and suspicious

The same people who didn't care about having their freedom to privacy breached claiming ITS CLEARLY A SHIPPING ERROR LOL.

<comment><USER24> And famous _security analysts_ are ALWAYS on that side of crowd, isn't that weird?????

</comment></comment><comment><USER47> The real story here is a small segment of productive coders rightfully feel themselves focus of nation sized actors that threaten their work.

...

Also the large segment around them that still feel dismissive about their now confirmed fears.</comment>


Volkswagen – detects when your tests are being run in CI, and makes them pass - <AUTHOR> https://github.com/auchenberg/volkswagen <comment><USER2> The joke was done a few days ago (I have no idea if this was the first either but its the first I saw)

[https://github.com/hmlb/phpunit-vw](https://github.com/hmlb/phpunit-vw)

(To those that don't get the joke, Volkswagon just got popped for cheating their emissions tests by detecting when they were in a test vs real world environment)

<comment> semi-extrinsic The Node.js addon linked in this story ("volkswagen") credits the PHP addon which you link to ("phpunit-vw") as their inspiration.

It seems somehow very appropriate that the Node.js version is the one that gets to the frontpage of HN even though the original idea was a PHP thing. Edit: and the PHP one was posted to HN yesterday, getting much less attention.

<comment><USER3> Yes, it's appropriate because the title of one submission sucked, and caused it to not succeed. ;)

> PHPUnit VW extension

> Volkswagen – detects when your tests are being run in CI, and makes them > pass

Tellingly, "Node" and "NPM" aren't in the title or URL. So much for bias.

</comment></comment></comment><comment><USER4> Earlier thread for phpunit: [https://news.ycombinator.com/item?id=10341405](https://news.ycombinator.com/item?id=10341405)

</comment><comment><USER5> I suppose this would be fair use of the Volkswagen trademark for parody, were it not for the fact that the VW brand is so well known that that would outweigh the parody exemption?

(I'm not a lawyer, but I need to protect some IP rights regularly, so trademark law interest me.)

<comment><USER6> Hi, I'm the dev. I've been thinking about it. I would consider it a success if we got a call from Volkswagen, so I'm willing to take that risk. That being said, I think they are way to busy at the moment ;)

</comment></comment><comment><USER7> For those that don't get the joke: [http://www.bbc.com/news/business-34324772](http://www.bbc.com/news/business-34324772)

</comment><comment><USER8> When would this be useful? Isn't the point of CI to ensure bugs don't make it to production?

EDIT: I get the joke now. Thanks to everyone who replied.

<comment><USER9> I'm pretty sure this is just a joke in response to this: [http://money.cnn.com/2015/09/21/investing/vw-emissions- cheat...](http://money.cnn.com/2015/09/21/investing/vw-emissions-cheating- shares/index.html)

</comment></comment><comment><USER10> Works on Codeship as well. The process.env.CI is set to true there as well.

</comment><comment><USER11> this would be useful....if i wrote tests, that is.

<comment><USER6> I got you covered. We've made a badge you can add to your README.md that will always show your tests as passing even if you don't have any :)

[https://github.com/auchenberg/volkswagen#why](https://github.com/auchenberg/volkswagen#why)

</comment></comment><comment><USER12> this is the ultimate HN troll. Luv it.</comment>


The decline and fall of the American middle class - <AUTHOR> http://www.guardian.co.uk/commentisfree/cifamerica/2011/sep/13/american-middle-class-poverty

<comment><USER2> "P&G, it transpires, is cutting back on marketing to the disappearing middle classes, instead selling more and more to either high-income or low-income customers and abandoning the middle."..."there is even a word for this strategy, helpfully coined by Citibank: the Consumer Hourglass Theory – because it denotes a society that bulges at the top and bottom and is squeezed in the middle."

Interesting. Same trend here in Sweden I think.</comment>


How to use KPIs in your Startup - <AUTHOR> http://ryancarson.com/post/28258737029/how-to-use-kpis-in-your-startup

<comment><USER3> If there ever was a certain way of killing morale in a startup it was by introducing KPIs and calling them KPIs.

<comment><USER4> I disagree. In a healthy startup, everyone wants to push towards the same goal and they welcome clarity and cohesion. We could've called them 'Buttercups'. The term doesn't matter - it's just an agreement of what the shared goal is.

<comment><USER5> Ryan - from what I've seen (we've recently started doing KPIs at our startup) - the more business-y people like them, and the more tech-y people hate them. To Sherman's point, their naming offends tech people - "KPI" sounds like it's meant to intentionally obfuscate, whereas "key metric" is the same number of syllables. Pretentious isn't the right word, but it's the first word that comes to mind.

I don't mean to say that they're not good - looking at yours, they seem very reasonable. We're introducing a Product team right now, over/with a dev team that's been otherwise self-reliant for the last two years, and there are growing pains with that process. As silly as it is, speaking everyone's language (not talking about KPI's or sending power points to devs, not sending Legal to GitHub to checkout your terms of service, etc) is important for buy- in.

That being said, yours is the first tech person's blog post about KPIs. I'll be sure to check back on it as we get our dashboard off the ground - <USER2> Ryan.

<comment><USER4> "KPI" is a common term that most people are aware of, so it's mostly about avoiding confusion.

<comment><USER5> It could well be - it's gained prominence in my company over the last 2 months, but I'd never heard of it before that. I actually googled it in a meeting with sales people, assuming it was a term native to the ad industry, and I laughed out loud when I read what it stood for. If it's been a common industry term for a few years, then maybe I'm at the "Late Majority" or "Laggards" part of the curve - though I suspect we're a little earlier than that.

It reminds me strongly of MVP - people that "get it" love it (I'm among them), and it changes the way that they think of things. However, it's buzz-word-y, and alienates those who don't. My point isn't that KPIs are a bad thing (or even a bad term), but there's an important subset of people who stop listening when you say it.

</comment></comment></comment></comment></comment><comment><USER6> I hope that this works out well for you and your team, however when reading the post I couldn't think of anything else but measuring developer's performance by lines of code.

</comment><comment><USER7> Thanks for sharing these. A few questions:

Do you track these on a rolling monthly basis or calendar months?

Why do you have social metrics like FB fans and Goolge +1s under Product?

To trace changes in these KPIs back to causes, you'll surely need to look at a finer timescale than a month. How do you do that?

</comment><comment><USER8> These KPIs are on a monthly basis, but do you have anything more fine-grained to track KPIs weekly? Perhaps I'm getting too focused..

<comment><USER4> It's hard to affect most KPIs in 7 days. However, it really depends on what you're measuring. For instance, you could switch a lot of the User Growth KPIs to weekly instead of monthly.</comment></comment>


1Password deletes passwords after payment lapse - <AUTHOR> https://twitter.com/feross/status/1305642039585812481 <comment><USER2> I am glad they delete data when an account is closed. I wouldn't want 1Password to keep my account around after I deleted my account. Maybe they should have a more lenient length of time to keep the account active when the card on file is declined but that's another story.

</comment><comment><USER3> Looking further in the thread they say it was probably a big more than anything and that it's not supposed to work like this. Of it was a policy I'd be more worried.

Not that I use it anyway, I host my own.</comment>


Update of Waterloo LEARN (Desire2Learn) - <AUTHOR> http://uwaterloo.ca/learn-help/news/message-provost-regarding-learn

<comment><USER2> From the company:

"As part of our major investment in next-generation infrastructure project within our SaaS facilities we began in the fall of 2012, many changes to our environment were required as part of our migration into this new environment.

One of these changes required a sophisticated process of migrating data to our new enterprise storage solution. We made a decision that it would serve our clients best to migrate this data over time, with the help of our vendors using technologies purpose-built for live migration. This methodology prevented the requirement for long, multi-day maintenance windows due to the large volumes of file data that need to be transferred. Effectively this "file virtualization" technology ("ARX") would allow the seamless use of both source and destination storage during the migration with no impact to users.

The issues currently being experienced have been determined to exist within the ARX technology. We are currently seeing different impact to different customers. For customers whom we had yet to begin the migration of their data, or for customers for whom we had completed the process, we were able to remove the ARX solution from their environment, resulting in a complete restoration of service.

For customers who are in midst of their data migration, the ARX cannot be removed, and we have initiated a separate restoration process that applies to a portion of customers. This process involves a configuration change to the internal format of metadata within the ARX. This change has shown to have a positive impact on the clients for whom this process has completed. However, this configuration change takes time to process, and we are targeting noon EST today for completion with clients seeing ongoing improvements as it makes progress."

Full contents here -- <http://desire4community.com/all-hands-on-deck/>

I admire the fortitude it takes to try doing a live migration for something like this; in hindsight, I'm sure everyone agrees that a well-scheduled maintenance outage isn't the worst thing that can happen. Here's hoping that all of the schools recover quickly. Good luck guys.</comment>


Ask HN: Facts you learned at school which aren't true any more? - <AUTHOR> Starting from a video of Scott Manley https://www.youtube.com/watch?v=1wIZ2sp39Cc I become very curious and excited to find out more subjects/topics like these.
What facts you learned at school are not true anymore?<p>Edit: I also found this link https://www.quora.com/Education/What-are-some-facts-still-being-taught-in-school-that-have-been-proven-to-be-false which was posted also on HN two years ago. <comment><USER2> Coriolis effect _doesn 't_ make toilet water swirl direction in the northern hemisphere and the other direction in the Southern Hemisphere.

</comment><comment><USER3> There are 9 planets.

Not just wrong, but geocentric universe, roast Giordano Bruno in _Campo de ' Fiori_ wrong.

</comment><comment><USER4> Pluto is not a planet.</comment>


Ask HN: about coffee - <AUTHOR>

- Do you drink coffee? How much and why? - What effects does it have on you? - Did you know that over 50% of Americans drink between 3-4 cups a day?<p>Personally I find it can work wonders when I need to squeeze out some work I really don't feel like doing... But I don't rely on it, I always try and take a few days to a week to detox once in a while. Also I'm a little concerned how it's affecting my weightlifting. <comment><USER2> I drink coffee on weekends with breakfast, I only have 1 cup so it doesn't have as much effect as something like 3 or 4 cups would, but I must say I have had 3 cups and I get really shaky and overly inattentive.

I do drink black tea though during the week about 3 times a week around 5 o-clock and it usually offers a pretty big boost when I'm feeling tired. I mostly just like the taste though.

</comment><comment><USER3> Yes. Average half a cup a day. I like the taste. It doesn't have any effect on me apparently. Didn't know that.

</comment><comment><USER4> Not really. Modafanil seems to work better and have fewer side effects.</comment>


Higher Order Components in TypeScript - <AUTHOR> https://www.matthewgerstman.com/ts-tricks-higher-order-components/ <comment><USER2> Very interesting, does anyone have experience with this pattern they can share?</comment>


Eric Schmidt Steps Down from Alphabet's Board of Directors - <AUTHOR> https://twitter.com/ericschmidt/status/1123324575436214272 <comment><USER2> Eric Schmidt was the anti-privacy leader who dismissed privacy concerns.

"If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place."

[https://www.eff.org/deeplinks/2009/12/google-ceo-eric- schmid...](https://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmidt- dismisses-privacy)

Keep in mind this is the same guy who blackballed CNET reporters for finding personal information on him through google search.

[https://money.cnn.com/2005/08/05/technology/google_cnet/](https://money.cnn.com/2005/08/05/technology/google_cnet/)

The guy represents every wrong with tech. Privacy for him, but none for thee. And that's not even including on his shady ties to government.

<comment><USER3> I will always remember him as the guy who would willingly collude with other mentees of Bill Campbell to not hire engineers from each others companies. Willingly trying to keep the salaries of engineers low is pure evil. They even tried to rope-in Zuckerberg into this gentleman's agreement. Zuck asked them to buzz off. When Eric is involved in shady practices like these, how do all other leaders on twitterverse who are singing his praises justify their pandering. I wonder if Eric would have survived now as a Google CEO. Half the company would walk out today, if they came to know Sundar is in bed with his other CEO buddies and has agreements not to poach employees from each other's companies.

<comment> ok-repl Those poor underpaid Googlers

<comment><USER4> ...higher salaries in one place tend to pull up salaries elsewhere too. And conversely, if you push down the top, you also push down the middle (under the optimistic assumption that the bottom can't go any further down...).

Also, it's easy for other industries to then justify with: "hey, even Google is doing it, and they were they guys supposed to 'do not evil', amirite?".

That's the problem with unethical behavior, we're all into copying and generalizing stuff :|

<comment><USER5> Indeed- I thank the FANGs everyday for pulling up my salary. In 2013 I was making about 1/3 what I am now in the financial industry in NYC doing algo trading/HFT. I was reluctant, but after years of seeming to miss out on the big money that everyone talked about finance people making, I finally just decided to look outside the industry. I got a remote job with a company in the valley, and got a 60% increase in comp, that after 3 years grew to just a hair shy of 100%. I was pretty much the first defector to leave finance for tech in my circles, but more followed. I jumped around one more time, with a financial company who truly pays top tier salaries (to match tech companies), and am now making a full 3x what I was just a bit over 5.5 years ago, with a much better work life balance and general work environment.

I can't imagine this would have happened without Goog/FB/Apple/Netfix, etc. Every day I reap the benefits of their competition for talent without having worked at any of them.

</comment></comment></comment></comment></comment><comment><USER6> This is of course extremely subjective, and I have no knowledge of what Google was and is on the inside except for a short internship almost 10 years ago: I somehow always felt that Google with Eric Schmidt as a CEO was a much different Google than later on. Under Eric Schmidt, Google seemed like this extremely innovative company with the brightest minds in the industry. Afterwards, it seemed to instead grow into just another corporation.

Though maybe that's just what growth does in general.

EDIT: I singled out Larry Page before, but that's a bit skewed, given that he founded Google and was its CEO for the first few years.

<comment><USER7> The other big thing was Larry pushed social on the company without really understanding social as a product, and was absolutely unable to handle the huge negative response both internally and externally to that push. This all happened at the same time Microsoft and Amazon committed to Cloud (which Google has only tepidly adopted).

The one time I met with Schmidt to explain my cloud project, he was delighted and encouraging and helped shape the design in a way that made it much more effective. He was a very effective leader (although not everybody agrees- some people think he's an arrogant asshole).

<comment><USER8> I think Page had the right idea, because if you look nowadays at people under 30 for them the Internet is represented by social networks, be it Facebook, Instagram, WhatsApp or even Snapchat, the internet/web represented by the browser and by visiting different websites via Google is no longer that important. I think Page realized that if Google doesn't hop on the social train they'll end up looking from the outside at a flowering walled garden in which they will have almost no relevance.

I think they had a similar idea after Apple's iPhone started gaining traction, it's only that in the case of Android Google's execution was an order of magnitude better compared to what they did with Google+. I wouldn't put the blame for the failure of Google+ on Page only, I'd also assign it to Gundotra, after all he was the man directly in charge of it all, Page's fault is that he chose and supported the wrong man for the job.

<comment><USER7> None of G+ was Page's idea. There was a product manager (who left for facebook!) who did the big pitch deck that got it rolling. Then they put Vic Gundotra in charge and gave him carte blanche to modify multiple products. I agree that was the wrong person for the job. But you can't even imagine the amount of groupthink and ego that Vic surrounded himself with.

I don't think it was super-obvious 10 years ago, but social has turned out to be a growth product that led to a minefield for the successful companies (look at Twitter and Facebook now) because the growth strategies were so sketchy that people and the government ultimately had to reject them.

Ultimately, it's on Page, though. He stood up at TGIF and told all the player to "get along" when Search had made a coherent argument that coupling the Social brand with search was brand suicide. I think Google could have made a much less obnoxious social network, maybe it would have been good, but without aggressive growth strategies, it wouldn't have been popular (a lot changed since the Orkut days, most people forget Google had a social network with half a billion users at one point!)

<comment><USER9> That's interesting. I think Google would have been better aiming for something closer to Twitter instead of trying to copy and mimic Facebook with Google+. Google's core strength has been organizing information as a data first company versus facilating social connections.

<comment><USER7> The original pitch deck for G+ ([https://www.businessinsider.com/heres-the- presentation-that-...](https://www.businessinsider.com/heres-the-presentation- that-inspired-google-2011-7)) really laid out a compelling view for a social network that worked well for people who had multiple distinct subnetworks ad they didn't want to cross the streams. Personally I thought the presentation was brilliant and I was behind the general strategy until Vic took over and started to wield the plus-hammer.

<comment><USER10> That strategy is dumb because in practice people don't mind or prefer using distinct apps for each of their subnetworks; and when these networks start overlapping in the same app, they start posting less (Facebook's problem), creating multiple accounts ("finstas" on Instagram), or bifurcating their real friends to another app (Snapchat 3 years ago).

Hell the fact that Snapchat succeeded in growing a credible threat to Facebook with a fraction of the engineering and marketing resources as Google+ should tell you how wrong that strategy was...

Each of the networks grew initially by providing an insanely better experience specific to a subnetwork (FB for alumni networks, Insta for narcissistic hobby photographers with its filters, Snapchat for horny teens who want to send nude pics, or who want to be goofy with its funny face filters...)

There were a few niches where Google+ unintentionally ended up being successful, such as internal to enterprise, and for pro photographers who liked that pictures had an option to be hosted uncompressed. But the vision overall had poor market fit and would never have latched on to a dense enough subnetwork to succeed IMO.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Good riddance. Among other problems, Schmidt was one of the organizers of the "no poaching" scandals:

[https://en.m.wikipedia.org/wiki/Eric_Schmidt#Role_in_illegal...](https://en.m.wikipedia.org/wiki/Eric_Schmidt#Role_in_illegal_non- recruiting_agreements)

He also wrote this, to make it clear that he knew he was doing wrong: [let's share this with competitors] "verbally, since I don't want to create a paper trail over which we can be sued later?"

<comment><USER12> "No poaching" is underselling it. It was wage fixing plain and simple.

He was also the one who, with a straight face, said "if you don't have anything to hide, you don't have anything to fear" in response to widespread surveillance. Of course, he would not then open himself up to any scrutiny.

<comment><USER13> I am surprised that the Feds didn't go after them or take an interest.

<comment><USER12> They did. And they were found guilty. This was widely reported years ago.

</comment></comment></comment></comment><comment><AUTHOR> "After over 18 years on the Board, Eric Schmidt is not seeking re-election at the expiration of his current term on June 19, 2019. He will continue as a technical advisor to Alphabet. Eric has served as a member of the Board since March 2001. He was Google's Chief Executive Officer from July 2001 to April 2011, and its Executive Chairman from April 2011 until January 2018."

From the press release: [https://abc.xyz/investor/news/releases/2019/0430/](https://abc.xyz/investor/news/releases/2019/0430/)

</comment><comment><USER14> I'll remember Eric Schmidt for sabotaging XMPP progress by saying something along the lines of "no one wants to support IM federation, so we should follow suit" and killing off Google Talk (which caused me to lose most of my IM contacts at that time).

<comment><USER15> About that - Facebook was leaching off Google's network graph by allowing cross-platform chats (initiated from Fb), but Google couldn't access Fb users from GTalk. IMO, it's a perfectly reasonable response in terms of game theory; the best course of action when the other party defects in a Prisoner's Dilemma scenario is to also defect.

<comment><USER14> If FB was a problem, Google could ban FB, and allow federation with those who federate back. They didn't and instead killed the whole thing.

It was a pretty bad response in the terms of actually fixing the messed up IM situation. It only made it worse, basically axing XMPP adoption. Game theory doesn't advise doing that. Compare it to one ally defecting. Others defecting in response (instead of looking for more allies) means losing the whole campaign right away, which is exactly what happened.

I don't use XMPP at all today and naturally none of my IM contacts are from Google or FB. Good thing something like Matrix is gaining traction. But I have little respect for Google today because of the above.

</comment></comment></comment><comment><USER16> I'm starting to read "When Google Met WikiLeaks" by Assange. In this book Schmidt is the villain. It will be nice to match Assange's point of view with all the eulogies that we will read about Schmidt now.

<comment><USER17> Schmidt's involvement with US's politics is strange, especially for the business leader: he met with Assange, he went to North Korea.

There was a hilarious moment at the company meeting when rank-and-file learned from the news that Eric and Larry met with Trump. Somebody demanded explanation, as if it is something strange that business leaders meet with the president. Sundar mumbled something like "yes, I didn't know they are going to meet, but this was a single meeting and many business leaders attended...". Eric rushed on stage and said "To clarify: I met with President Trump more than once, bla bla".

<comment><USER18> Some of those leaked videos of the Google team discussing politics with their top management at one of those meetings, are disturbing.

<comment><USER19> Link or it doesn't exist

<comment><USER17> Ironically, one google search away: there is a surreal leaked video of company-wide meeting after Trump Election:

[https://www.breitbart.com/tech/2018/09/12/leaked-video- googl...](https://www.breitbart.com/tech/2018/09/12/leaked-video-google- leaderships-dismayed-reaction-to-trump-election/)

Google's response: "Nothing was said at that meeting, or any other meeting, to suggest that any political bias ever influences the way we build or operate our products."

Which of course is not true, as was ironically demonstrated on the same meeting pre-election, when instant answer cards in search results were popping up for Hilary queries, but not for Trump queries.

</comment></comment></comment></comment></comment><comment><USER20> Does anyone inside Google care to share how Eric is perceived among fellow engineers?. From the outside, it seems many of the great innovations came when he wS CEO and Larry + Sergey were building the company culture.

<comment><USER7> it's kind of a bimodal distribution. many engineers hated him with a passion but then they would learn he wrote lex and set up early networks at Berkeley and kind of come around to the idea that he was a very successful technobusinessman who confronted Microsoft repeatedly.

<comment><USER21> > he wrote lex

Wow, didn't expect that. I used it back in my uni days for a compiler project.

</comment></comment></comment><comment><USER22> Really enjoyed listening to this recent interview with Eric Schmidt.

I'd never heard of Bill Campbell before, seems like he was a huge influence around Silicon Valley.

[https://tim.blog/guest/eric-schmidt/](https://tim.blog/guest/eric-schmidt/)

<comment><USER23> For a counterpoint on Campbell as a terrific business coach read "Hatching Twitter" [1]. He was hired as Ev Williams' coach and the picture the book paints is bad. Working more for the board of directors instead the person he was hired to help. Telling Williams he was doing great then reporting to the board he was doing terrible.

The book is also a great way to understand why Twitter is such a shit show of an organization. The fundamental mismanagement from day one until now also shows the power of finding product/market fit. As the saying goes, you can mess everything else up and still succeed.

[1] [https://www.goodreads.com/book/show/18656827-hatching- twitte...](https://www.goodreads.com/book/show/18656827-hatching-twitter)

<comment><USER24> It's really hard to tell what in this book is based in fact. It's almost entirely based off of hearsay and gossip. There are interviews with people recalling minute details of conversations they had ~5 years in the past. You can call bullshit on a lot of it.

<comment><USER23> Really good point.

My high-level take away though is that it is directionally correct regarding Twitter and its (mis)management.

</comment></comment></comment></comment><comment><USER25> "\-- Google Inc.'s top three executives agreed in 2004 to work together at the Internet search and advertising giant for at least 20 years, a company spokesman confirmed on Wednesday."

[http://online.wsj.com/article/SB120172640635329643.html](http://online.wsj.com/article/SB120172640635329643.html)

</comment><comment><USER12> I do hope that his notions about Google's place in society goes with him. The things he wrote in 'A New Digital Age' were terrifying. Simply because they made a great amount of money, he viewed Google as the clearest guide for societies future. He advocated for Google taking an active role in attempting to shape social thinking. That might sound good to some, but I know too much history to be willing to support it. The unintended consequences that come from any attempted society-wide engineering are universally horrific.

</comment><comment><USER26> Somehow it's strange seeing these tech giants being handed over to a new generation. Microsoft has long been associated with Gates and Balmer, Steve's DNA still runs in Apple, and Google still reminds me of Schmidt. The newer generation of executives and board directors in these companies has a very difficult task to do: stick to the past or redefine the company for the future.

<comment><USER27> Steve Jobs of course famously left Apple (not on the friendliest of terms), then returned several years later to "redefine the company for the future" (very successfully of course). His return marked a major new period for Apple, with major changes in direction and execution.

</comment></comment><comment><USER28> He's lucky he ruled when he did. Nowadays he'd have been exposed and destroyed for his sexual harrassment (which is why he stepped down originally) and other horrible behavior.

</comment><comment><USER29> Why is a Google Board Member announcing stuff on Twitter?

Is Google wasting all their resources creating dozens of incompatible chat apps, but no blogging platform?

<comment><USER30> Just to clarify, because we all saw the chat thing. They don't need _another_ blogging platform. Just a modern update to Blogger will do.

</comment></comment><comment><USER31> Dropping the Pilot? [1]

[1][https://en.wikipedia.org/wiki/Dropping_the_Pilot](https://en.wikipedia.org/wiki/Dropping_the_Pilot)

<comment><USER32> I'm not well-enough versed in history to follow the analogy. Are you saying Schmidt is being asked to leave because of internal differences? Did Bismarck leaving have good/bad implications after the fact that you are alluding to here?

<comment><USER33> Bismarck was a whiz of foreign policy, who had successfully juggled the alliances surrounding the (relatively nascent by European standards) German state throughout his time as a diplomat and Chancellor.

His contemporary Hohenzollern monarch (Wilhelm's II predecessor) largely allowed Bismark to take free reign over diplomacy, recognizing him as a generational talent.

If Bismarck was an ideological juggler, capable of accepting political loss in the short-term to catch out his adversaries in the long-term, Wilhelm was a firebrand, who refused to play games with "the enemy" (especially the Russians), even if they benefited the long-term survival of his state and person.

The cartoon shows Bismarck stepping off the ship, leaving Wilhelm to take over. While this is perhaps an unflattering characterization of Bismarck, it reflects that, even in 1890, it was known that Wilhelm would not be able to lead the nation better than this forcibly-retired titan of European diplomacy.

Bismarck _probably_ could have stayed on the ship, because its sailors were largely aligned with him, but he was getting old (75 when he retired); and he tired of suffering the youth and ignorance of the not-so-subtle monarch. His most immediate, and unfortunate legacy was the black hole he left unfilled.

The aftermath was a complete lack of long-term thinking, that led to all the European countries (even Russia!! who had a hard time getting along with the UK/France in particular) agreeing to form alliances against Germany. It's quite reasonable to point to Bismarck's departure as the first big slip down the slippery slope that led to WWI.

Compare this to Eric Schmidt leaving Google (filled with young Wilhelm IIs?) how you will.

<comment><USER34> Curious who the analogous Wilhelm II is in Google today? Sundar is not one - Sundar is actually very diplomatic and strategically-minded, which is how he ended up CEO of Google in the first place (he managed to avoid all the political struggles common to Google's SVPs at the time, such that he became the obvious successor when they all left to run VCs / got fired for sexual harassment / became top brass at Yahoo/Softbank/Twitter). If anything, Larry was the Wilhelm II who picked fights with a lot of big up-and-comers, but even he was pretty restrained and strategic about it.

Google's problem now is that anything smaller than a billion-dollar business is not on their radar screen, which means that by definition they are going to miss the next growth industry. And they don't really have anyone in the company who can do anything about that, because you don't go to Google because you want to work on the small problem that might become big, you go to Google because you want to work on big problems.

<comment><USER35> _Google 's problem now is that anything smaller than a billion-dollar business is not on their radar screen_

That seems quite wrong, given that: 1\. Google can buy into growth opportunities by making aquisitions. 2\. Google is invested in many, many pre- billion-dollar businesses.

</comment></comment></comment></comment></comment><comment><USER36> Better late than never, but the main question is who are left behind and do they have the same mindset as Eric. He is the virus that has multiplied well. Just another member in the club of Gates, Ellison, Ballmer, Jobs, Zuckerberg & more.

Question is, can we undo the damage done. In 2019 lingo, reverse the Thanos snap. Not sure of Sundar but I still hope that Google twins might do the right thing.

</comment><comment><USER37> Who replaces him?

<comment><AUTHOR> Robin Washington is replacing both Eric Schmidt and Diane Greene.

Press release: [https://abc.xyz/investor/news/releases/2019/0430/](https://abc.xyz/investor/news/releases/2019/0430/)

</comment></comment><comment><USER38> Google is an internet monopoly with data and information. I think the only reason they've come this far without being exposed as such was cooperating with the government (learning from Microsoft's mistakes when they were exposed)

<comment><USER39> What do they have a monopoly on? The claim that Google, or any FAANG company is a monopoly is absurd. A monopoly is the exclusive possession or control of the supply of or trade in a commodity or service. Google definitionally doesn't have that, because competitors exist.

<comment><USER40> While definitely not a monopoly under the contemporary definition, I do not find it hard to believe that these companies are having an outsized influence on markets, society and politics. They end up having monopolistic effects without actually being a monopoly.

Case in point, it's extremely hard to get discovered on internet without paying google/Facebook. Even if you are not running ads, google can wipe out a significant chunk of your internet traffic with their algorithm changes. Or google's insane policy for Android OEM manufactures (which EU took a notice of). Amazon controls your retail presence - you can't have cheaper products anywhere else. If you have a particularly popular product, Amazon will make its own version.

The average consumer still has an abundance of choice and low prices so the current market powers of these companies do not fit the definition of monopoly that was applied to Microsoft in the 90s. I think there needs to be another word or the definition of a monopoly needs to be updated. These companies still have an influence which teeters close the impact created by historical monopolies.

<comment><USER41> There's no law against that, and we (USA) try to be a country of law.

<comment><USER42> That's why you add new laws to prohibit things you find damaging to society.

</comment></comment></comment></comment></comment><comment><USER43> This is what happens when your drops 8% and they move your stock to hold.

</comment><comment><USER44> [https://www.eff.org/deeplinks/2009/12/google-ceo-eric- schmid...](https://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmidt- dismisses-privacy)

</comment><comment><USER45> Good riddance. I won't miss him.

</comment><comment><USER46> Good riddance!

</comment><comment><USER47> So what is the moonshot failure rate now? 100%?

</comment><comment><USER48> schmidt happens

</comment><comment><USER49> I still dislike that they called the company Alphabet, because it's something that we teach our youngest. Commercialization starts early.

<comment><USER50> It's meant to be alpha-bet, where alpha is investment return above benchmark.

<comment><USER49> Ahh that makes sense, like seeking alpha. I was thinking it was due to indexing things from A to Z.

<comment><USER50> There is definitely double entendre going on, which is why they picked that name. At the surface it means one thing, but it has a second more relevant meaning hidden in there. They make bets which make great returns on investments, and these bets cover everything from A to Z.

</comment></comment></comment></comment><comment><USER51> Google seems to be falling flat on its face growth-wise. Its ad revenue is down, its Pixel 3 platform fell completely flat, it shuttered Google + and had a security breach?

How can you have a large scale security breach with a brutal tech hiring process, sky high salaries and a whitepaper-producing workforce? Hell, when you interview at much smaller firms, the tech groups copycat the Google hiring techniques, that's the extent of the influence. Google is a reference implementation that everyone copycats.

Then is the Pixel 3's lack of creative innovation symbolic of a strong tech culture that seems to prize science and tech over creativity? For reference, they copied the iPhone in numerous ways aesthetically and marketing-wise: the size is identical, glass replaced metal, the price was pumped up to make it appear premium, even the color names have goofy Apple-y names, etc.

<comment><USER52> Complete aside: all of my friends/acquaintances who work for Google (and in full disclosure, they're generally not engineers) unequivocally agree that Google could fire 30% of their workforce with no disruption in service/revenue.

They've become bloated.

<comment><USER53> > Google could fire 30% of their workforce with no disruption in > service/revenue.

Isn't that true for a large amount of large tech companies?

I was under the impression that a large amount of the workers are working on incremental improvements to existing services or working on new features/services entirely. If those people stop working that shouldn't disrupt the service and you shouldn't see the revenue fall until a competitor catches up & out innovates.

<comment><USER54> I think it's more that there are a large number of employees who don't actually contribute much and treat it like a retirement gig. I've seen people who are only in the office from 10-5, take long breaks for lunches, socializing, working out, massages, etc. and regularly "WFH" one day a week on top of that, and clearly aren't very productive (note: there are people who keep that kind of schedule and _do_ get a lot done; I'm not talking about them).

It's possible to give the appearance of being busy and valuable if you make every project way more complex than it needs to be by scheduling lots of meetings that end up mostly involving bike shedding, publishing lots of design docs and spreadsheets to gain visibility, submitting mediocre code so that you can subsequently submit lots of cleanup CLs, and so on. The game is easier to play these days because the company is so large that entire teams can go off the radar and not have to be accountable.

This happens at every big company and it isn't the norm at Google, but it happens quite often. It's really hard to fire employees, and a pain for managers. It's way easier to just let them be, and for a low-mid level manager that can even make it easier for them to justify additional headcount, which makes their org bigger and increases their standing.

<comment><USER55> Why is it hard to fire employees? Workers have extremely weak protections in the United States. I never buy this argument. If google wanted to clean shop they can, other tech companies do it regularly (IBM, Oracle, etc).

<comment><USER54> In addition to what vkou said, firing individuals for low performance in the US, as opposed to mass layoffs, typically requires putting them through the PIP process (performance improvement plan), which is onerous and stressful for the manager. My limited understanding is it involves the manager, HR, and employee agreeing on a project and timeline that would constitute satisfactory performance, then constantly checking in and documenting progress. The purpose is for the company to collect proof the employee can't perform their job to indemnify themselves.

But I've seen people just temporarily work really hard and/or get lots of help while they're on a PIP, succeed at it, and then revert to old habits. In a lot of cases rather than go through the trouble to put a report through a PIP, which may not have the desired outcome anyway, the manager will just put them off in a corner and give them unimportant tasks, making it that much easier for them to just coast.

<comment><USER56> Also, doing so demonstrates a failure on the manager's part (How did they let a formerly good report get so bad that they need a PIP? Were they paying any attention to what they were doing for the past year?)</comment></comment></comment></comment></comment></comment></comment>


To get a ride, Uber says take a walk - <AUTHOR> https://apnews.com/75c1112621134a7bab84d34b51acd7ea/To-get-a-ride,-Uber-says-take-a-walk <comment><USER2> Silicon Valley has invented the jitney/marshrutka, just a little bit over a century after everyone else did. Well...congratulations?

<comment><USER3> And then they'll find that they always end up sending those vehicles down the same streets, and start using bigger vehicles, and they'll reinvent the bus.

<comment><USER2> Mind you, _re_ inventing something is great (e.g. typing this from a radically reinvented phone). This, OTOH, is just inventing square wheels and patting oneself on the back for being original.</comment></comment></comment>


OpenAI releases larger GPT-2 model - <AUTHOR> https://openai.com/blog/better-language-models/#update <comment><USER2> Notably, the 345M model (1.5 GB on disk) is big enough that it's pushing the limits of conventional GPUs, and an alternative method of finetuning the model ([https://github.com/nshepperd/gpt-2/commit/47df6da611716b4826...](https://github.com/nshepperd/gpt-2/commit/47df6da611716b4826e3397cd68d711c6951c8e5)) has to be used to prevent the GPU from going OOM.

I'm working on tools to streamline GPT-2 text generation: I'm currently porting the code above to gpt-2-simple ([https://github.com/minimaxir/gpt-2-simple](https://github.com/minimaxir/gpt-2-simple)) to allow easy finetuning/generation, and am also working on a way to quickly build an API/client for easily deploying GPT-2 to production and generating text at scale and cost effectively. Even the 117M model, managing CPU and RAM performance is tricky.

But given the incredible results of just the 117M model (e.g. Hacker News titles from a retrained 117M model: [https://github.com/minimaxir/hacker-news- gpt-2](https://github.com/minimaxir/hacker-news-gpt-2)), I'm eager to put the 345M model through its paces.

<comment><USER3> >(e.g. Hacker News titles from a retrained 117M model: [https://github.com/minimaxir/hacker-news- gpt-2](https://github.com/minimaxir/hacker-news-gpt-2))

Wow, thats great. "The Bullshit Bubble" "Fuck you, Bootstrap" "We should give up on America" - they're practically comedy, yet very believable too.

<comment><USER4> Has anybody tried feeding it comedy to begin with to see what it spits back out?

<comment><USER2> There was an attempt on Reddit but it didn't turn out well, likely because there wasn't enough input data: [https://www.reddit.com/r/MachineLearning/comments/bgvzdu/d_j...](https://www.reddit.com/r/MachineLearning/comments/bgvzdu/d_jokes_generated_via_gpt2/)

(I have an idea for a more proper approach)

</comment></comment></comment></comment><comment><USER5> Worth noting that the new 345M model is still far from the full 1.5B model they were avoiding to post. The headline makes it seem like they finally decided to give the full model, but it's just a slightly larger demo model.

<comment><USER6> It strikes me as weird that they are not publishing it, by the way. According to their rhetoric when they started, it was the whole purpose of OpenAI: acknwoledging that we are at point when anybody with enough resources can produce something, let's say, _interesting_ with ML, and striving to give everyone more or less equal possibilities by serving as a more effective academic organization for the world, before Facebook or Google takes over the world completely.

Plus, it's not as if this thing is more "potentially harmful" than, well... basically anything of use, like electricity, internet, fire, less perfect language models. In fact, it isn't even anything new, it's just (possibly) less broken language model than what we already have.

Admittedly, it would be quite problematic to use the full model with today's mainstream GPUs, so I'm not that much saddened by them hoarding on it. It just seems curious to me.

</comment></comment><comment><USER7> While I appreciate that this is a large advance, I'm worried that these releases will make the internet completely worthless after some time. If AI can come up with fake news, fake text, fake videos and pretty much anything the user wants it to, then we will be flooded with biased content that's untrustable. There's probably some critical percentage of AI generated content on the web that guarantees this happening. (I'm guessing it's around 40%)

<comment><USER8> Their release strategy is to provide lower quality models to the public while giving research partners access to the full models. The goal of this approach is to let researchers devise methods of detecting and counteracting this new technology. It's kind of like "this technology is going to exist so we need to prepare responsibly."

</comment></comment><comment><USER9> Oh wow, I was literally just making a toy Discord bot for GPT-2. Guess I'll update it with the bigger model.

EDIT: Done! It takes about 3x longer than it did before to generate a response, so if you try it be very patient. Also, I made this in three hours so I wouldn't be surprised if it goes up in flames at some point.

[https://github.com/ScottPeterJohnson/gpt2-discord](https://github.com/ScottPeterJohnson/gpt2-discord)

<comment><AUTHOR> How long does it take, and which hardware do you use?

<comment><USER9> About 30 seconds for a smaller response on an EC2 instance. Mind you this is without a GPU because I couldn't figure out how to set one up.

</comment></comment></comment><comment><USER10> Maybe a dumb question - how does the model which is trained to predict the next words answer questions, as shown in the reading comprehension example? Do you just feed it the question and watch it generate the answer, or is something else going on?

<comment><USER11> you add a linear classifier at the top to predict start and end positions of the answer span. The augmented model is trained on a qa dataset like squad to actually learn how to answer questions.

hugging face has a simple implementation that augments bert in this manner and you can see the code there. their bertqa model get like an 84 F1 on squad 1.1 which really strong performance. you can augment the thier gpt2 implementation similarly.

<comment><AUTHOR> I think they used gpt-2 for qa without any finetuning.

</comment></comment></comment><comment><USER12> People should be equally astonished by what this model can create as they should be by what vacuous, insipid garbage passes for writing these days. Some of the worst offenders being corporate CEOs spewing bullshit while people sift through the verbal excrement trying to figure out what they had for breakfast at 4:00 hoping it will make them rich too.

</comment><comment><USER13> If you guys want some background check out this blog post:

[https://openai.com/blog/better-language- models/](https://openai.com/blog/better-language-models/)

It's fascinating to think an AI wrote that story...

<comment><USER14> That's actually the same page as the main link (which is scrolled down to the update).

</comment></comment><comment><USER15> > Due to our concerns about malicious applications of the technology, we are > not releasing the trained model.

Has anyone said when they are intending to release the full model? There's likely a lot of positive applications of this technology as well.

<comment><AUTHOR> They said within 6 months, however by that time there will likely be something better.

<comment><USER16> > They said within 6 months, however by that time there will likely be > something better.

There has. BERT has come out and is better.

<comment><USER17> BERT is bidirectional. How do you use that for language generation?

<comment><USER18> It will generate words for every [UNK] in its input sequence.

<comment><USER17> It'll generate one token because it's trained to predict one missing UNK, as I understood it. What is the scaffolding? Do you generate random sentences and iterate repeatedly? And how does that get you whole coherent paragraphs? (Has anyone demonstrated that this actually works with BERT?)

<comment><USER16> BERT can pretty easily be used to generate text. It's intended to be used as a base model and fine-tuned with an additional model on top. The fine-tuning model could then be trained to generate sentences with the underlying language model powered by BERT.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Tangentially, is there any estimation of the amount of words/sentences that a kid may have heard by the time he or she learns to talk?

</comment><comment><USER20> Maybe I'm too naive here, but I'm not seeing the potential malicious usage of this model. People will generate text, and then what?

<comment><USER21> Especially what kind of usage that could not already be achieved by asking a human to write a text.

<comment><USER22> It makes it cheaper, faster, and effectively infinitely scalable. You'll run out of man hours and people to generate this stuff by hand than you can launching a ton of resources in the cloud.

With the main concerns being troll army/fake news type stuff, I don't think this makes a difference. We seem pretty sure there are state level actors behind a lot of that stuff, and I think it would be silly to believe they can't recreate something at the level of GPT-2, especially with the underlying principles out there and understood, competitors like BERT available, etc.

I think their heart is in the right place, but also incredibly naive.

</comment></comment></comment><comment><USER23> in other words: "we can't release our finding before retraining it on filtered Reddit data-set, cause we haven't released our first finding for a reason... stay tune for more trained model with filtered content" ( what's the fuzz about the first fully trained model?" )

</comment><comment><USER24> Here's a summary: we are aware of the fact that this model will harm society and we are releasing it anyway. We are fiddling around with the way it's released in an attempt to absolve ourselves of blame while simultaneously collecting the profit in the form of a juicy acquisition.

The net result of these advanced forms of signal processing will be negative. Nobody has come forward to prove that they will benefit society on the whole or even that they are safe. But anyone who raises concern is shouted down and called names like "alarmist" and "Luddite."

These companies are playing with fire, and the whole world stands to be burned. Wake the fuck up.

<comment><USER25> _Someone_ is going to invent this model sooner or later, simply because it is possible. There is not much sense in trying to stop it. We just have to adapt.

<comment><USER24> That's not correct. What you are saying is that there is no plausible organized effort that could stop or slow the creation of signal processing models that will have pronounced negative impacts. The error is on two levels: you are using too much analogy with other technologies. And you are writing off the possibility of stopping ai when it's still not clear that it can't be stopped.

This isn't something that can be built and tested in isolation like other things we are familiar with. Training these models is not an exact science. Nothing about ai is an exact science. Progress only comes with trial and error. And each trial requires huge compute resources; at least for the most capable and dangerous models. It can't be done in your basement. Not without significant effort and drawing attention to yourself. Could we sense whenever someone was trying to do it? Could we form a global coalition to stop every attempt? That brings us to the next thing.

What you are doing is the following: we are both in a car that is about to roll off a cliff. I propose that we try pressing the brakes. You respond by saying that, geez it looks like we probably wouldn't stop in time — we are going awfully fast and it probably wouldn't work to press the brakes so why even try? Let's just brace our heads and hope the impact doesn't kill us.

Obviously the better thing to do is to try and press the brakes. Even if you aren't sure if you can stop in time.

<comment><USER26> I think if you try to be less cynical about what OpenAI is doing you might even find them an ally to your perspective. Facebook throwing pocket change at an AI ethics org and Google's rather embarrassing failure at staffing an ethics panel of its own is evidence that we've got bicycle brakes on a freight train.

OpenAI suffered a ton of blowback for not just releasing the full model from the start. You can read their intitial blog post [1] looking particularly at the sections for Policy Implications and Release Strategy. I would also highly recommend you listen to Lex Fridman's podcast with Greg Brockman [2] to hear their rationale about the recent org changes at Open AI.

Obviously you can posit that everything they say is bullshit and they are only after almighty dollars. I can't prove it's not true and personally believe there is at least a kernel of truth to it, but we live in a messy world and finding imperfect allies is generally better than having none at all.

[1] - [https://openai.com/blog/better-language- models/](https://openai.com/blog/better-language-models/)

[2] - [https://www.youtube.com/watch?v=bIrEM2FbOLU](https://www.youtube.com/watch?v=bIrEM2FbOLU)</comment></comment></comment></comment>


Show HN: Vagrant replacement in ~250 lines of code in Python 3 - <AUTHOR> https://github.com/afiskon/py-vm <comment><AUTHOR> @brudgers suggested to re-send this link as "Show HN" [https://news.ycombinator.com/item?id=12834893](https://news.ycombinator.com/item?id=12834893) Sorry for a copy, unfortunately I'm unable to edit or delete an original submission.

</comment><comment><USER2> Without the ability to drive over vm back ends its not much of a replacement IMO.

Virtual box is a pig on macOS. With Veertu now available for free I'm not sure why anyone would choose virtual box any more.</comment>


How To Choose A Niche For Your Startup That Gets You To Critical Mass - <AUTHOR> http://platformed.info/facebook-harvard-seeding-growth-traction/

<comment><USER2> Good start..I would say in terms of finding a niche Google keyword tool and a tool like secockpit are great for finding niche goldmines</comment>


What caused the mass panic at Newark airport? - <AUTHOR> https://www.buzzfeednews.com/article/amberjamieson/alaska-airlines-newark-chaos <comment><USER2> "Alaska Airlines did not answer any questions about the employee who caused the commotion, saying it does not comment on personnel. CBS 2 reported that a source told them the woman has bipolar disorder and had missed her medication."

an allegedly mentally ill airline employee, harassed and assaulted pax, and raised a false alarm and i would project, made a false security report.

This should be quite enough, its time that airline security was returned to a realistic stance, and such individuals were removed from service. Its a damn good thing this didnt happen in flight, and involve operation of the aircraft.

there was already a single case of a small air craft pilot having a passenger suddenly take over the yoke and violently resist attempts to stop him holding the plane in a nose dive. This incident in submission is not a rare one, but everyone took her seriously, due to recency of other lethal incidents</comment>